template.yml

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"

Description: >
  GitHub Secret Scanner Auto Remediator (GSSAR)

Resources:
  ### Lambda Functions ###

  ## Authorizers

  GitHubWebhookSecretValidator:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/authorizers/githubWebhookSecretValidator
      Description: "A Lambda that validates a GitHub Secret"
      Environment:
        Variables:
          NODE_ENV: Production
          REGION: !Ref "AWS::Region"
          EVENT_BUS_NAME: !Ref GSSAREventBus
      Events:
        GatewayEndpoint:
          Properties:
            ApiId: !Ref HttpApi
            Method: POST
            Path: /github/webhook/validate
          Type: HttpApi
      Handler: lib/main.handler
      Policies:
        - AmazonSSMReadOnlyAccess
        - EventBridgePutEventsPolicy:
            EventBusName: !Ref GSSAREventBus
      Runtime: nodejs14.x
      Timeout: 60
      Tracing: Active

  GitHubWebhookIPValidator:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/authorizers/githubWebhookIPValidator
      Description: "A Lambda Function that validates the IP comes from GitHub"
      Environment:
        Variables:
          NODE_ENV: Production
          REGION: !Ref "AWS::Region"
      Handler: lib/main.handler
      Policies:
        - AmazonSSMReadOnlyAccess
      Runtime: nodejs14.x
      Timeout: 60
      Tracing: Active

  ## Helpers

  GetSecretDetails:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/helpers/getSecretDetails
      Description: "A Lambda function that calls the GitHub API to return details about the given Secret in question"
      Environment:
        Variables:
          NODE_ENV: Production
          REGION: !Ref "AWS::Region"
      Handler: lib/main.handler
      Policies:
        - AmazonSSMReadOnlyAccess
      Runtime: nodejs14.x
      Timeout: 60
      Tracing: Active

  GitHubIssueNotifier:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/helpers/githubIssueNotifier
      Description: "A Lambda function that creates a GitHub Issue to Notify the repository of the secret remediation"
      Environment:
        Variables:
          NODE_ENV: Production
          REGION: !Ref "AWS::Region"
      Handler: lib/main.handler
      Policies:
        - AmazonSSMReadOnlyAccess
      Runtime: nodejs14.x
      Timeout: 60
      Tracing: Active

  CloseSecret:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/helpers/closeSecret
      Description: "A Lambda function closes the GitHub Secret that has been remediated"
      Environment:
        Variables:
          NODE_ENV: Production
          REGION: !Ref "AWS::Region"
      Handler: lib/main.handler
      Policies:
        - AmazonSSMReadOnlyAccess
      Runtime: nodejs14.x
      Timeout: 60
      Tracing: Active

  ## Remediators

  RemediateAWSAccessKey:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/remediators/remediateAWSAccessKey
      Description: "A Lambda that remediated AWS Access Keys"
      Environment:
        Variables:
          NODE_ENV: Production
          REGION: !Ref "AWS::Region"
      Handler: lib/main.handler
      Policies:
        - AmazonSSMReadOnlyAccess
        - Statement:
            - Sid: IAMGet
              Effect: Allow
              Action:
                - iam:ListAccessKeys
                - iam:UpdateAccessKey
                - iam:DeleteAccessKey
                - iam:CreateAccessKey
                - iam:GetAccessKeyLastUsed
              Resource: "*"
      Runtime: nodejs14.x
      Timeout: 60
      Tracing: Active

  RemediateGoogleAPIKey:
    Type: "AWS::Serverless::Function"
    Properties:
      CodeUri: functions/remediators/remediateGoogleAPIKey
      Description: "A Lambda that remediates Google API Keys"
      Environment:
        Variables:
          NODE_ENV: Production
          LOCATION: global
      Handler: lib/main.handler
      Policies:
        - AmazonSSMReadOnlyAccess
        - Statement:
            - Sid: IAMGet
              Effect: Allow
              Action:
                - iam:ListAccessKeys
                - iam:UpdateAccessKey
                - iam:DeleteAccessKey
                - iam:CreateAccessKey
                - iam:GetAccessKeyLastUsed
              Resource: "*"
      Runtime: nodejs14.x
      Timeout: 60
      Tracing: Active

  ### Event Bus ###

  GSSAREventBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: !Join ["-", [GSSAR, !Ref AWS::StackName]]

  ### API Gateways ###

  HttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      FailOnWarnings: True
      RouteSettings:
        "POST /github/webhook/validate":
          ThrottlingBurstLimit: 10
      Auth:
        Authorizers:
          LambdaAuthorizer:
            AuthorizerPayloadFormatVersion: "2.0"
            EnableSimpleResponses: true
            FunctionArn: !GetAtt GitHubWebhookIPValidator.Arn
            FunctionInvokeRole: !GetAtt LambdaInvokeRole.Arn
        DefaultAuthorizer: LambdaAuthorizer

  ### IAM Roles & Policies ###

  StepFunctionsApiRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: AllowSFNExec
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: "states:StartExecution"
                Resource: !Ref SecretScannerStateMachine

  LambdaInvokeRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action:
              - "sts:AssumeRole"

  LambdaInvokePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: "LambdaInvokePolicy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: "lambda:InvokeFunction"
            Resource: !GetAtt GitHubWebhookIPValidator.Arn
      Roles:
        - Ref: "LambdaInvokeRole"

  ### State Machines (Step Functions) ###

  SecretScannerStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: stepfunctions/secretscanner.yml
      DefinitionSubstitutions:
        GitHubWebhookSecretValidatorFunctionArn: !GetAtt GitHubWebhookSecretValidator.Arn
        RemediateAWSAccessKeyFunctionArn: !GetAtt RemediateAWSAccessKey.Arn
        RemediateGoogleAPIKeyFunctionArn: !GetAtt RemediateGoogleAPIKey.Arn
        GetSecretDetailsFunctionArn: !GetAtt GetSecretDetails.Arn
        GitHubIssueNotifierFunctionArn: !GetAtt GitHubIssueNotifier.Arn
        CloseSecretFunctionArn: !GetAtt CloseSecret.Arn
      Type: EXPRESS
      Events:
        EBRule:
          Type: EventBridgeRule
          Properties:
            EventBusName: !Ref GSSAREventBus
            RetryPolicy:
              MaximumRetryAttempts: 2
            DeadLetterConfig:
              Type: SQS
              QueueLogicalId: SecretScannerDeadLetterQueue
            Pattern:
              source:
                - custom.kickOffSecretScanRemediation
              detail-type:
                - transaction
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref GitHubWebhookSecretValidator
        - LambdaInvokePolicy:
            FunctionName: !Ref RemediateAWSAccessKey
        - LambdaInvokePolicy:
            FunctionName: !Ref RemediateGoogleAPIKey
        - LambdaInvokePolicy:
            FunctionName: !Ref GetSecretDetails
        - LambdaInvokePolicy:
            FunctionName: !Ref GitHubIssueNotifier
        - LambdaInvokePolicy:
            FunctionName: !Ref CloseSecret
        - CloudWatchLogsFullAccess

Outputs:
  HttpApiUrl:
    Description: URL of your API endpoint
    Value:
      Fn::Sub: "https://${HttpApi}.execute-api.${AWS::Region}.${AWS::URLSuffix}/"
  HttpApiId:
    Description: Api id of HttpApi
    Value:
      Ref: HttpApi